     (add-bidi-protection-wrapper
      routes
      :http-request-authenticator (new-session-based-request-authenticator :http-session-store (:http-session-store this) :user-roles user-roles)
-     :failed-authentication-handler (->BidiFailedAuthenticationRedirect (get-in (:login-form this) [:handlers :get-handler]))))
+     :failed-authentication-handler (->BidiFailedAuthenticationRedirect (get-in (:login-form this) [:handlers :login]))))
 
   NewUserCreator
   (add-user! [_ uid pw]

;; Since this module is dependent on bidi, let's provide some sample
;; bidi routes that can be used as-is or to demonstrate.

(defn new-login-get-handler [handlers-p post-handler-key {:keys [boilerplate] :as opts}]
  (fn [{{{requested-uri :value} "requested-uri"} :cookies
        routes :modular.bidi/routes}]
    (let [form
          [:form {:method "POST" :style "border: 1px dotted #555"
                  :action (bidi/path-for routes (get @handlers-p post-handler-key))}
           (when requested-uri
             [:input {:type "hidden" :name :requested-uri :value requested-uri}])
           [:div

             {:username username
              :expiry (+ (.getTime (java.util.Date.)) (* expiry-seconds 1000))})
      ;; TODO: Make this cookie name configurable
      ;; TODO: Use, or remain compatible with, session stores from ring-session
      {:value uuid
       :max-age expiry-seconds}))
  (get-session [this cookies]
    (when-let [{:keys [expiry] :as session} (->> (get cookies "session") :value (get @(:sessions this)))]
      (when (< (.getTime (java.util.Date.)) expiry)
        session)))
  (end-session! [this value]
    (swap! (:sessions this)
           dissoc value)))

(defn new-atom-backed-session-store [expiry-seconds]
  (->AtomBackedSessionStore expiry-seconds))
